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~ The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )^ Responsive to connmunication(s) filed on 26 August 2005 , 
2a)n This action is FINAL. 2b)^ Tliis action is non-final. 

3) n Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-12 and 29-32 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) 0 Claim(s) is/are allowed. 

6) ^ Claim{s) 1-7,9-12 and 29-32 is/are rejected. 

7) ^ Claim(s) 8 is/are objected to. 

6)\Z\ Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9)0 The specification is objected to by the Examiner. 

10)0 The drawing(s) filed on is/are: a)n accepted or b)n objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 1 )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12)n Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-{d) or (f). 
a)n All b)n Some * c)^ None of: 

1 .□ Certified copies of the priority documents have been received. 

2.n Certified copies of the priority documents have been received in Application No. . 

3.0 Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 



Attachnrient(s) 

1 ) K Notice of References Cited (PTO-892) 4) □ Interview Summary (PTO-41 3) 

2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) Paper No(s)/Mail Date. , 

3) O Infonnation Disclosure Statement(s) (PTO-1449 or PTO/SB/08) 5) □ Notice of Infonnal Patent Application (PTO-152) 

Paper No(s}/Mail Date . 6) □ Other: , 



U.S. Patent and Trademark Office 
PTOL-326 (Rev. 1-04) 
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DETAILED ACTION 
Election/Restrictions 

1 . This is in response to the Prelimary aemndment and Response to the the second 
restriction requirement (Group I (1-15) and Group II (claims 29-32)). In response, the 
Applicant provisionally elects Group II (claims 29-32) with traverse. However, the 
Applicant amends claims 1-12 into dependent form of elected claim 29. Therefore, 
claims 1-12 and 29-32 are presented for examination. Affirmation of this election must 
be made by applicant in replying to this Office action. Claims 13-15 are withdrawn from 
further consideration by the examiner, 37 CFR 1.142(b), as being drawn to a non- 
elected invention. 

2. Claims 1-12 and 29-32 are presented for examination. 

Claim Rejections - 35 (JSC §112 

3. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

4. Claim 32 is rejected under 35 U.S.C. 1 1 2, second paragraph, as being indefinite 
for failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. 

In claim 32, it is unclear what Applicant means by "and for still others". 

5. Claim 32 recites the limitation "the same service" and "the illusion of a first 
network". There is insufficient antecedent basis for this limitation in the claim. 
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Claim Objections 

6. Claim 2 is objected to because of the following informalities: 

There is a duplicate "at" in limitation "at at least one of said...". Applicant is 
required to remove one "at" in the limitation. 

In claim 1 , "whereby" should be changed to "wherein". . 
Appropriate correction is required. 

Claim Rejections - 35 USC § 102 

7. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in a patent granted on an application for patent by another filed in the 
United States before the invention thereof by the applicant for patent, or on an international application 
by another who has fulfilled the requirements of paragraphs (1 ), (2), and (4) of section 371 (c) of this 
title before the invention thereof by the applicant for patent. 

The changes made to 35 U.S.C. 102(e) by the American Inventors Protection Act 
of 1999 (AlPA) and the Intellectual Property and High Technology Technical 
Amendments Act of 2002 do not apply when the reference is a U.S. patent resulting 
directly or indirectly from an international application filed before November 29, 2000. 
Therefore, the prior art date of the reference is determined under 35 U.S.C. 1 02(e) prior 
to the amendment by the AlPA (pre-AlPA 35 U.S.C. 102(e)). 

8. Claims 1-7, 9-12 and 29-32 are rejected under 35 U.S.C. 102(e) as being 
anticipated by Shostack et al., US pat. No.6,298,445. 
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As to claim 29, Shostack discloses a method of providing deception at a computer 
system on a network comprising: 

accepting, at said computer system (16 fig.1), network protocol datagrams 
addressed to different computers (see abstract, fig.1, col.4 lines 7-45); and 

responding, by said computer system, to received datagrams using different 
deception emulations so that a receiver perceives that a number of different computer 
systems have been reached (see fig. 2, col.6 line 46 to col. 5 line 36 and col. 6 lines 37- 
65 and col. 8 lines 5-54). 

As to claim 30, Shostack discloses a method of protecting a computer network against 
unwanted attacks comprising: 

routing datagrams addressed to non-existing computers to a deception system 
(see abstract, fig.1, col.4 lines 7-45); and 

at said deception system, responding to said datagrams using varying 
emulations (see fig.2, col.6 line 46 to col. 5 line 36 and col.6 lines 37-65 and col.8 lines 
5-54). 

As to claim 31 , Shostack discloses said emulations vary based on one or more 
parameters including datagram addresses, time, or usage statistics (see fig. 5, col. 12 
lines 14-65 and col. 13 lines 7-64). 



Application/Control Number: 09/696,893 Page 5 

Art Unit: 2151 

As to claim 32, Shostack discloses an emulation at a particular IP address translates 
the same services differently for different remote access points, creating for some, the 
illusion of a first network, for others the illusion of a service system with a vulnerable 
deception target, and for still others, access to other systems (see fig.5, col. 12 lines 14- 
65 and col. 13 lines 7-64). 

As to claim 1 , Shostack discloses providing a plurality of actual logic systems of at least 
two distinct types; providing a communication channel to said actual logic systems; and 
running logic instructions on said actual logic systems whereby two or more said actual 
logic systems respond on said communication channel as though each were multiple 
logic systems, wherein an actual logic system responds as though it were multiple logic 
systems similar to its type (see fig. 2, col. 5 lines 7-51 and coL6 line 37 to col. 7 line 54). 

As to claim 2, Shostack discloses at least one of said actual logic systems, responding 
to multiple incoming addresses on said communication channel as though said at least 
one logic system were multiple logic systems (see fig.5, coL12 lines 14-65 and col. 13 
lines 7-64). 

As to claim 3, Shostack discloses on at least one actual logic system, providing varying 
responses (see fig.5, col. 12 lines 14-65 and col. 13 lines 7-64). 
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As to claims 4 and 5, Shostack discloses said responses vary based on an incoming 
address and varying time and use characteristics (see fig. 5, col. 12 lines 14-65 and 
col. 13 lines 7-64). 

As to claim 6, Shostack discloses said responses of said two or more actual logic 
systems are altered over time to emulate characteristics of real networks (see col. 9 • 
lines 1-54 and col. 13 lines 7-64). 

As to claim 7, Shostack discloses said emulation is used to deceive unauthorized users 
trying to access one or more protected logic systems (see fig.5, col. 12 lines 14-65 and 
col. 13 lines 7-64). 

r 

As to claim 9, Shostack discloses said emulation is controllable from one or more 
control systems (see fig.5, col. 12 lines 14-65 and col. 13 lines 7-64). 

As to claim 10, Shostack discloses said one or more control systems comprise one 
or more distributed control systems (see col.9 lines 1-54 and col.13 lines 7-64). 

As to claim 1 1 , Shostack discloses said distinct types comprise different operating 
systems (see fig.5, col.12 lines 14-65 and col.13 lines 7-64). 
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As to claim 12, Shostack discloses different operating systems and different hardware 
platforms (see fig. 5, col. 12 lines 14-65 and col. 13 lines 7-64). 

Allowable Subject Matter 

9. Claim 8 would be allowable if rewritten to overcome the Claim Objections, set 
forth in this Office action and to include all of the limitations of the base claim and any 
intervening claims. 

10. The above mention claims are allowable over the prior art of record does not 
appear to each or render obvious the claimed limitations in combination with the specific 
added limitations as recited in independent claims and subsequent dependent claims. 
None of the cited prior art discloses or teaches a method of providing deception at a 
computer system on a network comprising a combination of: emulation is used to 
deceive unauthorized users trying to access one or more protected logic systems by 
providing deceptive responses to unauthorized datagrams so as to lead an 
unauthorized user to believe the user has accessed an actual computer system. 



Other prior art cited 

1 1 . The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

a. Orchier et al, US pat. No.6,070,244. 

b. Hill et al, US pat. No.6,088,804. 

c. Zuili et al, US pat. No.6.145,084. 
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Conclusion 

12. Claims 1-7, 9-12 and 29-32 are rejected. 

13. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Khanh Dinh whose telephone number is (571) 272- 
3936. The examiner can normally be reached on Monday through Friday from 8:00 A.m. 
to 5:00 P.m. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Zarni Maung, can be reached on (571) 272-3939. The fax phone number 
for this group is (571 ) 273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see.http://pair-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-217-9197 (toll-free). 

Khanh Dinh 

Primary Patent Examiner 
Art Unit 2151 
11/14/2005 



